JP7361905B2 - Fault detection response in robot arm - Google Patents

Description

TECHNICAL FIELD This invention relates to controlling robot arms, and more particularly to detecting and responding to failures in robot arms.

FIG. 1 illustrates a typical robot 100 for performing operations. The robot 100 is composed of a base 101, a robot arm 102, and an instrument 103. The base 101 supports the robot and is itself firmly attached to, for example, the floor, ceiling, or cart. A robotic arm 102 extends between the base and the instrument. The robot arm is composed of rigid links 104 interspersed with flexible joints 105. Thereby, the robotic arm is articulated and can move its distal end and thus the instrument within the workspace. The instrument includes a shaft 106 and an end effector 107. End effector 107 is located at the most distal position of the instrument from the robot arm. The end effector is involved in the motion that the robot is performing. For example, the robot may be an industrial robot in a vehicle manufacturing plant for performing operations on vehicles. As another example, the robot may be a surgical robot for assisting or performing a surgical procedure.

Each of the robot arm joints 105 is driven by a motor. In response to detecting a fault in a robot arm, it may be desirable to hold the robot arm in place while the fault is evaluated. It is known that this is done by applying mechanical braking to each motor of the robot arm. However, incorporating mechanical braking into the drive train of each motor increases the weight of the robot arm and occupies space within the robot arm. A lighter and more compact solution is needed.

According to a first aspect, a first link connected to a second link by a joint, the first link allowing the second link to move relative to the first link. a motor for driving the joint; and a controller for controlling the motor, the controller controlling the motor to maintain a position of the joint relative to gravity in response to detection of a failure in the robot arm. A robot arm is provided, comprising a controller configured to electrically brake a motor by applying a braking current to the controller.

The motor may be a polyphase motor, and the polyphase motor includes a motor winding, a motor drive circuit for applying a drive signal to the motor winding, and a motor drive circuit for each phase of the polyphase motor. A load switch for connecting a power source.

A multiphase motor may include three phases, and a controller may be configured to apply braking current to all three phases of the motor in response to detecting a failure of the robot arm.

A controller, in response to detecting a failure in the robot arm, applies a braking current only between the first pair of phases of the motors, from the first phase of the first pair to the second phase of the first pair. can be applied.

In response to the controller continuing to detect a failure of the robot arm subsequent to applying the braking current of the previous paragraph, the first phase of the second pair of motors only during the phase of the second pair of motors. A braking current may be applied from the phase of the second pair to the second phase of the second pair.

In response to the controller continuing to detect a failure of the robot arm subsequent to applying the braking current of the previous paragraph, the first phase of the third pair of motors is A braking current may be applied from the phase to the second phase of the third pair.

In response to the controller continuing to detect a failure of the robot arm subsequent to applying the braking current of the previous paragraph, the second phase of the first pair of motors is A braking current may be applied from the phase of the first pair to the first phase of the first pair.

In response to the controller continuing to detect a failure of the robot arm following the application of the braking current of the previous paragraph, only during the second phase of the second pair of motors, the second A braking current may be applied from the phase of the second pair to the first phase of the second pair.

In response to the controller continuing to detect a failure of the robot arm subsequent to applying the braking current of the previous paragraph, the second phase of the third pair of motors is A braking current may be applied from the phase to the first phase of the third pair.

The failure may be a loss of power, and the controller may electrically brake the motor in response to the detection of the loss of power by connecting a braking current to the motor from a primary power source external to the robot arm.

The failure may be a loss of power, and the controller may electrically brake the motor in response to the detection of the loss of power by connecting a braking current to the motor from a backup power source external to the robot arm.

A robotic arm may be mounted on the cart, and the backup power source may be a rechargeable battery contained within the cart.

Following the application of braking current from the backup power source, the controller brakes the motor from a further backup power source connected to the motor independently of the primary power source and the backup power source in response to continuing to detect a loss of power. It may be configured to connect a current.

An additional backup power source may be a non-rechargeable battery that can only provide enough power to maintain the joint's position relative to gravity for less than 5 minutes.

In response to detecting a fault on a single phase of a polyphase motor, the controller opens the load switch on that single phase to isolate the motor windings on that single phase from the motor and on the other phases of the motor. applying a braking current;

The motor may include a current sensor between the load switch and the motor drive circuit for each phase of the polyphase motor, the current sensor configured to signal a fault in the phase to the controller when the current limit is exceeded. is configured.

Each motor drive circuit may be configured to drive its respective motor winding in a pulse width modulation (PWM) mode, and the motor drive circuit may include a high-side transistor and a low-side transistor for driving the PWM signal. . The motor may further include a circuit for detecting that the high-side transistor and the low-side transistor are operating to generate a PWM signal for each phase of the polyphase motor, the circuit detecting that the PWM signal is generated. A failure in a phase may be signaled to the controller if the phase is not detected.

A first comparator configured to compare the voltage supplied to the winding during high pulses of the PWM signal to a high threshold and a first comparator configured to compare the voltage supplied to the winding during low pulses of the PWM signal to a low threshold. a second comparator configured to compare to the threshold, the circuit signaling a fault to the controller if the voltage supplied to the winding is below the high threshold or above the low threshold. It is configured as follows.

The high-side transistor and low-side transistor of each motor drive circuit may be connected in series, and each motor drive circuit may further include a capacitor connected in parallel with the high-side and low-side transistors.

The joint may allow the second link to rotate about the axis relative to the first link, such that the braking current locks the rotational position of the joint relative to the current configuration of the robot arm. , which provides a locking torque to the joint.

The braking current may provide an initial torque to the joint to stop movement of the joint before providing a locking torque.

The invention will now be described by way of example with reference to the accompanying drawings. The diagram is shown below.
A known robot arm is illustrated. Figure 2 illustrates an articulated robotic arm. A motor for driving a joint of a robot arm is illustrated. 4 illustrates an exemplary structure of the phases of the motor of FIG. 3; FIG. A sensor built into a motor is illustrated. 4 illustrates an example structure of the power supply of FIG. 3; It is a flowchart which illustrates the starting procedure of a joint motor. A series of holding states after failure detection is illustrated.

The following disclosure relates to controlling a robot 200 of the type illustrated in FIG. The robot consists of a robotic arm 202 connected at one end to a base 201 and at the other end to an instrument 203. Robotic arm 202 comprises a series of links 204 interspersed with flexible joints 205. Each flexible joint allows the links it connects to move relative to each other. Flexible joints may include revolute joints, each of which allows the links it connects to rotate relative to each other about an axis. The flexible joints may include telescopic joints, each of which allows the links it connects to extend relative to each other along an axis. Instrument 203 includes a shaft 206 and an end effector 207 for performing operations.

Each joint is driven by a motor 208. A joint controller 209 controls a motor to drive a joint. Each joint of the robot arm may be driven by a separate motor. Preferably the motor is located proximal to the joint. For example, of the two links that the joint connects, the motor may be located on the link that is most proximal to the base of the robot arm. However, in some situations, the motor may be located on the distal-most link at the base of the robot arm. Each joint motor may have a dedicated joint controller to control the motor. Alternatively, the joint controller may control more than one joint motor.

FIG. 3 illustrates an example motor 300 for driving joint 205 of robot arm 202. FIG. Motor 300 is a polyphase motor. The motor has a rotor and a stator, and a plurality of windings attached to one of the rotor and stator for acting on the other of the rotor and stator. Each winding is connected at one end to the other windings and at the other end to a motor phase. Current is driven continuously through the windings to rotate the rotor relative to the stator, thereby producing torque that can be used to drive joint 205. In the example shown in FIG. 3, the motor has a first phase U301 connected to a first winding U302, a second phase V303 connected to a second winding V304, and a third winding W306. It is a three-phase motor, with a third phase W305 connected to the motor. However, more commonly, a motor may have more than three phases.

Each phase of the motors 301, 303, 305 includes load switches 307, 308, 309 and motor drive circuits 310, 311, 312. The load switch connects power from the power rail 313 to the motor drive circuit for that phase in response to control inputs 314, 315, 316 from the joint controller 317. The motor drive circuit applies drive signals 318, 319, 320 to the motor windings of that phase in response to control inputs 321, 322, 323. Power is provided to power rail 313 from power supply 324 .

FIG. 4 illustrates an exemplary structure of motor phases 301, 303, 305 of FIG. Load switches 307, 308, 309 include switch 400, which may be implemented by a transistor. For example, switch 400 may be implemented with a field effect transistor (FET). Motor drive circuit 310, 311, 312 may include two transistors, high side transistor 401 and low side transistor 402. Each of transistors 401, 402 may be implemented by a FET.

High side transistor 401 and low side transistor 402 are connected in series. Load switch 400, high-side transistor 401, and low-side transistor 402 are all connected in series, and high-side transistor 401 is between low-side transistor 402 and load switch 400. The other side of load switch 400 is connected to power supply rail 313. The other side of low-side transistor 402 is connected to ground 403. The drive signals 318, 319, and 320 are output to a drive signal line 410 connected between the high-side transistor and the low-side transistor. The motor drive circuit may additionally include a capacitor 411 connected in parallel with the high-side transistor 401 and the low-side transistor 402. Specifically, capacitor 411 is connected to one side of high-side transistor 401 and the opposite side of low-side transistor 402. In other words, capacitor 411 is connected between switch 400 and high-side transistor 401 and between low-side transistor 402 and ground 403. Capacitor 411 protects the high-side and low-side transistors in the event of a load switch failure that causes excessive current to flow into the motor drive circuit. In this scenario, capacitor 411 prevents some of the current from flowing through and thus damaging the high-side and low-side transistors.

Joint controller 317 includes a load switch control unit 404 for generating and outputting control input 407 to load switch 400 . Control input 407 controls load switch 400 to close, thereby connecting power from the power rail to the motor drive circuit. Control input 407 also controls load switch 400 to open, thereby disconnecting power from the power rail to the motor drive circuit. Joint controller 317 includes a high-side gate driver 405 for generating and outputting high-side gate input 408 to high-side transistor 401 . High side gate input 408 controls high side transistor 401 to enable and disable current through it. Joint controller 317 includes a low-side gate driver 406 for generating and outputting low-side gate input 409 to low-side transistor 402 . Low-side gate input 409 controls low-side transistor 402 to enable and disable current through it.

The joint controller drives the gates of high-side transistor 401 and low-side transistor 402 to generate a pulse width modulated (PWM) drive signal on drive signal line 410. Thus, in operation, the joint controller controls the load switch of the first motor phase U to close and provides high and low side gate driver inputs to the motor drive circuit for driving the first winding U. The motor is driven by generating a PWM drive signal. The joint controller then provides high and low side gate driver inputs to cause the motor drive circuit to continue generating the PWM drive signal. The joint controller repeats this process for each of the other motor windings in turn. Optionally, the joint controller may control a motor phase load switch that is not currently generating a PWM drive signal to open. This prevents power from being connected to the motor drive circuits of these phases.

FIG. 5 illustrates an exemplary three-phase motor as shown in FIG. 3, with joint controller 317 and each motor phase 301, 303, 305 having the structure shown in FIG. A load switch control unit of joint controller 317 provides control inputs 407a, 407b, 407c to load switches 400a, 400b, 400c for each motor phase, respectively. A high side gate driver 405 of joint controller 317 provides high side gate inputs 408a, 408b, 408c to high side transistors 401a, 401b, 401c, respectively, for each motor phase. A low side gate driver 406 of the joint controller 317 provides a low side gate input 409a, 409b, 409c to each of the high side transistors 402a, 402b, 402c of each motor phase.

The motor of FIG. 5 also includes multiple sensors. Each motor phase includes a current sensor 500a, 500b, 500c located between that phase's load switch and the motor drive circuit. The current sensor may be, for example, a current sensing resistor. A current sensor has a current limit. The current limit may be predefined. For example, the current limit may be 20A. The current sensor output is connected to joint controller 317 (not shown). The current sensor is configured to signal joint controller 317 if the current passing through the current sensor exceeds a current limit.

Each motor phase has a sensor for detecting whether the voltage of the drive signal to the motor windings is above a high threshold during high pulses of the PWM signal and below a low threshold during low pulses of the PWM signal. Equipped with a circuit. Preferably, the circuit detects the voltage towards the end of the pulse. For example, the voltage may be detected during the second half of the pulse.

By this time the voltage should be stable. FIG. 5 illustrates an example implementation of a sensor circuit with two comparators. The circuit is identical for each of the three motor phases. A circuit for monitoring the first motor phase U will now be described.

The two comparators 501a, 502a each have the drive signal 318 as one input 503a, 506a. The first comparator 501a has as its other input 504a the above-mentioned high threshold. The high threshold may be, for example, a percentage of the supply voltage on supply rail 313. The ratio may be between 0.8 and 0.99. The ratio may be between 0.9 and 0.95. The ratio may be 0.95. A first comparator compares the drive signal voltage to a high threshold. The first comparator output 505a indicates whether the drive signal voltage is above or below its high threshold. The second comparator 502a has as its other input 507a the low threshold described above. The low threshold may be, for example, a percentage of the supply voltage on supply rail 313. The ratio may be between 0.01 and 0.2. The ratio may be between 0.05 and 0.1. The ratio may be 0.05. A second comparator compares the drive signal voltage to a low threshold. The second comparator output 508a indicates whether the drive signal voltage is above or below the low threshold. The output of each of comparators 501a and 502a is connected to joint controller 317 (not shown). The comparator thereby signals to the joint controller whether the drive signal voltage is above or below the high and low thresholds.

FIG. 6 illustrates an example structure of power supply 324 shown in FIGS. 3 and 5. Power source 324 includes primary power source 601 . Primary power may be provided by a mains power supply. This may be routed to the robotic arm via other components of the system. For example, if the robotic arm forms a slave component of a master-slave manipulator and operates under the control of a master component located at a remote console, primary power may be supplied to the robotic arm from the console.

Power source 324 may also include backup power source 602. Backup power supply 602 has a different source than primary power supply 601. The source may be at a different location than the primary power source. The sources may be connected to the power rail 313 via different power lines, eg, via different cables, to the power line connecting the primary power source 601 to the power rail 313. The backup power source may be a battery stored locally on the robot arm. For example, the battery may be contained within a cart to which the robotic arm is attached. Preferably, the backup power source is a rechargeable battery. The backup power supply is controlled to provide power to the power supply rail 313 in the event that the primary power supply 601 fails. Preferably, the backup power source has sufficient stored energy to power the operation of the robotic arm so that the robotic arm can perform its intended operation for a predetermined period of time after the primary power source fails. enable us to continue implementing what we are doing. This predetermined period may be 5-10 hours.

Power supply 324 may also include an additional backup power supply 603. Further backup power supply 603 has a different source than primary power supply 601 and backup power supply 602. The source may be at a different location than the primary and/or backup power source. The sources may be connected to the power rail 313 via different power lines, for example, to the power line(s) connecting the primary power source 601 and the backup power source 602 to the power rail 313 via different cables. Additional backup power can be a battery housed within the cart or on the robot arm. The battery is significantly smaller than the rechargeable battery of backup power source 602. Batteries may be non-rechargeable. Further backup power supply 603 is controlled to provide power to power supply rail 313 in the event that backup power supply 602 fails. The additional backup power supply has sufficient energy stored to power the operation of the robotic arm for a very short period of time after the backup power supply fails. This predetermined period of time may be up to 5 minutes. The default period may be 30 seconds.

FIG. 6 illustrates several diodes 604, one between each power source and power rail 313. These diodes 604 ensure that power is delivered in a unidirectional manner from the power supply to the power supply rail 313 and that no current flows back into any of the power supplies from the power supply rail 313.

FIG. 6 also illustrates a circuit 605 for sensing the voltage provided by power supply 324. The circuit includes a comparator 605 having as its input a power supply rail 313 and a further input. That further input may be variable depending on which power supply is active. For example, the further input may be a percentage of the expected supply voltage from the active power supply. The ratio may be, for example, 0.95. In this case, the output from comparator 605 identifies whether the power supply rail is within 5% of the expected maximum supply voltage. The system may be driven at different voltages by the same power supply at different times during the testing process. Further inputs may be variable depending on the voltage at which the system is being driven at the time. The output of the comparator may be input to joint controller 317.

The following describes testing the motor arrangement described herein for failure during a robotic arm startup procedure. The test procedure is performed internally by the robotic arm and may therefore be called a power-on self-test (POST). Preferably, the joint controller passes sensed data received from the motor to the fault controller. The fault controller may be a central controller located external to the robot arm, which receives sensed data from each individual joint controller of the robot arm. The fault controller controls the joint controller to implement POST, and upon fault detection, the fault controller controls the joint controller to implement a response to the fault detection, as described below.

FIG. 7 illustrates an example POST sequence for testing joint motors of a robot arm during startup. In step 701, the motor phase to be tested is set to the first motor phase, ie, i=1. In the motor of FIG. 3, this is motor phase U. In the next step 702, the motor is driven to a known state. Preferably, this known state is a state in which the motor voltage is known. For example, a known condition may be one in which the voltage across each winding of a polyphase motor is zero. For the three-phase motor described herein, this may be accomplished by the joint controller 317 controlling the load switches 307, 308, 309 for each motor phase to open via control inputs 407a, 407b, 407c. In addition, the joint controller may control the low-side transistors of each motor phase to allow current to flow through the low-side transistors via low-side gate inputs 409a, 409b, 409c. These two effects together cause the motor to enter a "passive braking" state in which the motor windings do not produce torque to drive the joints.

In the next step 703, the first motor phase U is connected to the power supply. Preferably, this is implemented by the joint controller 317 to control the closing of the first phase load switch 400a to connect power from the power rail 313 to the motor drive circuit 310 of the first motor phase U. be done. Joint controller 317 controls load switch 400a to close, while controlling load switches 400b, 400c of other motor phases to remain open. Preferably, during this time the joint controller continues to control the low side transistors of all motor phases and remains on.

In the next step 704, the PWM signal is driven through the motor drive circuit 310 of the first motor phase U. Preferably, this is implemented by a joint controller 317 that applies gate drive inputs 408a, 409a to high and low side transistors 401a, 402a in a PWM sequence, as described above. Thereby, a PWM drive signal 318 is generated and output from the motor drive circuit 310 to the first phase winding U302. During this time, the joint controller continues to control the load switch 400a of the first motor phase U, which is closed, and the load switches 400b, 400c of the other motor phases, which are open.

In the next step 705, the motor is driven to a known state. Preferably, this is implemented in the same manner as described with respect to step 702. The known state of the motor in step 705 may be the same as the known state of the motor in step 702. The known state of the motor in step 705 may be different from the known state of the motor in step 702. Therefore, the joint controller controls all motor phase load switches 400a, 400b, and 400c to open. The joint controller may also control the low-side transistors of each motor phase to be on.

In the next step 706, the PWM signal is driven through the motor drive circuit 310 of the first motor phase U. At this point, the load switch 400a of the first motor phase U is open, thus disconnecting the first motor phase U from the power supply rail 313. Joint controller 317 applies gate drive inputs 408a, 409a to high and low side transistors 401a, 402a in a PWM sequence, similar to step 704. During this time, the joint controller continues to control the load switches 400b, 400c of the other motor phases V, W which are open. If the motor drive circuit includes an optional capacitor 411a, opening the load switch 400a and applying the PWM sequence discharges the capacitor 411a.

In the next step 707, it is determined whether there is a motor phase after the current motor phase. In other words, does i=i+1 exist? For the motors described herein, there is a second motor phase. Therefore, the answer to the question in step 707 is "yes" and the method proceeds to step 708, where i is set to i+1. In other words, i is set to 2. Steps 702-706 are then repeated for the second motor phase V. When step 707 is reached in this iteration, a third motor phase is present. Therefore, the answer to the question in step 707 is "yes" and the method proceeds to step 708, where i is set to i+1. In other words, i is set to 3. Steps 702-706 are then repeated for the third motor phase W. When step 707 is reached in this iteration, the answer to the question is "no" for three-phase motors. Therefore, the process moves to step 709 and the sequence ends. For polyphase motors with more than three motor phases, further iterations of the flowchart of FIG. 7 will be completed, once for each motor phase.

Each step in the flowchart of FIG. 7 may be performed for a predetermined duration before proceeding to the next step. The steps of FIG. 7 are performed in the order shown.

While the sequence of FIG. 7 is being performed, sensed data from the motor is fed back to the fault controller to test whether the motor is operating as expected. Preferably, the tests described below are performed during all steps of the flowchart shown in FIG.

First, the fault controller may test for each motor phase whether the current from the power rail to the motor drive circuit exceeds the current limit. For example, the fault controller may use the output of each motor phase's current sensor 500a, 500b, 500c to determine whether the current passing through the current sensor exceeds the current limit. The current limit may be predefined. Alternatively, the current limit of the current sensor may be reconfigurable. For example, the current limit may be set in real time to a value close to the expected current supplied from the power rail. Therefore, if the expected supplied current changes, the current limit of the current sensor is reconfigured accordingly. Preferably, the current limit is set to the maximum expected supplied current. The fault controller detects a fault when it receives an indication from the current sensor that the current limit has been exceeded.

Second, the fault controller may test, for each motor phase, whether the voltage supplied to the motor windings of that motor phase differs from each of the power rail voltage and ground by more than a respective amount. . For example, while the first motor phase is driven in PWM mode in step 704 of FIG. 7, the fault controller uses the outputs of comparators 501a and 502a to determine whether the voltage supplied to the first winding is It may be determined whether a high threshold is exceeded during high pulses of the PWM signal and/or whether the voltage provided to the first winding is less than a low threshold during low pulses of the PWM signal. The fault controller implements the same process as the other motor phases when they are driven in PWM mode in step 704 of FIG. The fault controller detects a fault if the voltage supplied to the winding is below a high threshold. The fault controller detects a fault if the voltage supplied to the winding is above a low threshold.

While the first motor phase is being driven in PWM mode in step 706 of FIG. 7, the fault controller uses the output of comparator 501a to ensure that the voltage supplied to the first winding is It may be determined whether a high threshold is exceeded during the pulse. The fault controller implements the same process as the other motor phases when they are driven in PWM mode in step 706 of FIG. The fault controller detects a fault if the voltage supplied to the winding is above a high threshold.

The high and low thresholds of comparators 501a, 501b, 501c and 502a, 502b, 502c are a percentage of the supply voltage. This percentage may be preset. Alternatively, this percentage may be configurable in real time.

Third, the fault controller may test whether the voltage supplied to the motor is below a threshold voltage value. For example, the fault controller may use the output of comparator 605 to determine whether the voltage provided to power supply rail 313 at time t is less than a threshold voltage value at time t. The threshold voltage value may be reconfigurable depending on which power supply is powering power supply rail 313. For example, the threshold voltage value may be a percentage of the expected supply voltage from the active power source. The fault controller detects a fault if the output of comparator 605 indicates that the supplied voltage is less than the threshold voltage.

The fault controller may also rely on sensed outputs from the motor to identify the source of the fault, as follows:
(i) The fault controller detects a fault in the high-side transistor of a motor phase if the voltage supplied to the winding of that motor phase is below the high threshold of comparator 501 during the PWM mode of step 704 of FIG. . For example, the failure may be that the high side transistor has shorted or is open.
(ii) The fault controller detects a fault in the low side transistor of a motor phase if the voltage supplied to the winding of that motor phase exceeds the low threshold of comparator 502 during the PWM mode of step 704 of FIG. For example, the failure may be that the low side transistor has shorted or is open.
(iii) The fault controller detects a fault at the load switch of the motor phase if the voltage supplied to the winding exceeds the high threshold of comparator 501 after a predetermined period of driving PWM mode in step 706 of FIG. do. For example, the fault may be that the load switch has short circuited.
(iv) upon receiving an indication from the current sensor 500 that the current limit has been exceeded, the fault controller detects a fault in the load switch of the motor phase and/or a fault in the high side transistor of that motor phase; Detects failure of low-side transistor.
(v) Fault The controller detects a power supply failure upon receiving an indication from comparator 605 that the voltage from the power supply has fallen below a threshold voltage for a time t for that power supply.

The fault controller may identify other sources of faults depending on the combination of sensed outputs from the motors. For example, a fault controller may identify that a motor winding is open or that one of the high or low side comparators is not functioning properly.

During each fault evaluation, the fault controller evaluates the output of all sensed data and status information that it receives from the motor and, following this evaluation, zeroes out one or more of the fault conditions listed above. Can be detected.

For each step in the flowchart of FIG. 7, if that step is performed for a predetermined duration and no failure is detected by the above test, the process proceeds to the next step. However, if a fault is detected during a step, the process may enter a fault state.

Upon entering a fault condition, the joint controller responds by electrically braking the motor. To do this, the joint controller applies a braking current to the motor to maintain the position of the joint that the motor drives relative to gravity. The joints are held in one configuration, thus preventing the links of the robot arm to which they connect from sagging under gravity. If the joint is a revolute joint, the braking current provides a locking torque to the joint, such as to lock the rotational position of the joint. The value of the fixing torque depends on the posture of the arm. In other words, the locking torque applied to the joint to lock its rotational position has one value for one configuration of the robot arm and another value for a different configuration of the robot arm. The value of the fixed torque, and therefore of the braking current, therefore depends on the position in which the joint is held and can be controlled by the joint controller accordingly.

The locking torque is sufficient to hold the rotational position of the joint against gravity. If the joint is moving below a threshold velocity at the time the fault condition is entered, the locking torque is sufficient to stop the joint movement at time T and hold the joint in its stopped position relative to gravity. It is. However, if the joint is moving above a threshold speed at the time the fault condition is entered, the locking torque is insufficient to stop the joint movement at time T. In this case, the joint controller electrically brakes the motor by applying a braking current that provides an initial torque with a value higher than the fixed torque. This initial torque is sufficient to stop the joint movement at time T. Once the joint is stopped, the joint controller then electrically brakes the motor by applying a fixed torque to hold the joint in the stopped position relative to gravity.

Braking current requires electrical power, and therefore electrical braking requires electrical power to hold the joint in place. Electric braking is applied by the same motor driving the joint's articulation, under the control of the same joint controller. No separate entity is involved in electrically braking.

The joint controller may electrically brake the motor by applying a braking current to all phases of the motor. For example, the joint controller may include (i) a load switch for each motor phase that is closed to connect power from the power rail 313 to the motor drive circuit for that phase; and (ii) a brake that passes to the motor windings for that phase. This may be implemented by controlling the motor drive circuit of each motor phase to connect the current.

If the fault controller identifies the fault source as being located on one of the motor phases, the joint controller opens the load switch for that motor phase, isolating that single phase's motor windings from the motor, and disconnects the motor from the motor. respond by applying braking current only to the other phase of the For example, if the fault controller identifies that a fault exists on the first motor phase U, the joint controller will (i) open the load switch 307 of the first motor phase; (ii) open the second motor phase U; controlling the motor phase load switch 308 to close and (iii) the third motor phase load switch 309 to open. In this way, the joint controller applies a braking current between the second and third motor phases, thereby holding the joint in its current configuration.

During a fault condition, the joint controller continues to receive sensed data from the sensors described above.

FIG. 8 illustrates a series of hold states, each of which applies braking current to the motor via a different component. The joint controller may control the motor to cycle through a series of hold states in the following situations:
(i) if the source of the failure has not been identified;
(ii) if multiple faults are detected;
(iii) following application of braking current to all phases of the motor, if sensing data received by the faulty controller continues to cause the faulty controller to detect a fault; or (iv) braking two phases of the motor. If, following application of current, sensed data received by the faulty controller continues to cause the faulty controller to detect a fault.

FIG. 8 illustrates six hold states, each of which applies braking current between two phases of the motor. State 801 applies a braking current between the first and second phases of the motor, from the first phase to the second phase. State 802 applies braking current between the second and third phases of the motor, from the second phase to the third phase. State 803 applies braking current between the first and third phases of the motor, from the first phase to the third phase. State 804 applies a braking current between the second and first phases of the motor, from the second phase to the first phase. State 805 applies braking current between the third and second phases of the motor, from the third phase to the second phase. State 806 applies a braking current between the third and first phases of the motor, from the third phase to the first phase.

Generally, to apply braking current from phase X to phase Y, the phase The Y load switch is opened. Additionally, the low side transistor of phase Y is driven to ground by the low side gate driver. The high side transistor of phase Y is opened. The other phase Z load switch is opened. The low-side transistor of phase Z is floating, ie, not connected to the power supply rail or ground. The high side transistor of phase Y is opened.

The joint controller controls the motor to cycle through a series of hold states, such as from state 801 to state 802 to state 803 to state 804 to state 805 to state 806 and back to state 801. If the source of the fault is not identified, if multiple faults are detected, or if a fault is detected when braking current is applied to all phases of the motor, the joint controller performs the retention shown in Figure 8. The motor may be controlled to initially apply braking current in either state. For example, the joint controller may control the motor to start in state 801. If a fault is identified in a single motor phase, the joint controller controls the motor to initially apply braking current initially in a hold state excluding that motor phase. For example, if a fault is detected on a first motor phase, the joint controller will cause the motor to first enter a holding state 802 or 805, neither of which applies holding current between the first phase and another phase. can be controlled. The joint controller may control the motor to always enter the same holding state in this situation, eg, always to state 802.

The joint controller controls the motor to apply a braking current in the holding state of FIG. 8 for a predetermined period of time. After this predetermined time, if the fault condition is no longer detected, the joint controller controls the motor to maintain the braking current in this holding condition. After a predetermined period of time, if the fault condition continues to be detected, the joint controller controls the motor to move to apply braking current at the next hold state in the cycle. The process continues to cycle through the states of FIG. 8, each time applying a braking current that is in the hold state for a predetermined amount of time before moving to the next state if a fault continues to be detected.

It will be appreciated that FIG. 8 illustrates one example cyclic order of states. The circulation order may differ from that shown in FIG. A cyclic order can be a series of states 801-806 in any order.

Generally, the joint controller is configured to electrically brake the motor by controlling the power supplied to the motor 300 from the primary power source 601. If the detected fault is a power loss, the joint controller may initially control the braking current supplied to the motor 300 from the primary power source 601. If the faulty controller continues to receive sensed data that causes it to detect a loss of power, the faulty controller causes the joint controller to disconnect the primary power source 601 from the power rail 313 and instead provide braking current to the motor. Backup power supply 602 is connected to power supply rail 313. If the faulty controller continues to receive sensed data that causes it to detect a loss of power, the faulty controller causes the joint controller to disconnect the backup power supply 602 from the power rail 313 and instead provide braking current to the motor. A further backup power source 603 is connected to power rail 313.

Alternatively, the fault controller may cause the joint controller to control the braking current provided to the motor from the backup power source 602 in response to initial detection of power loss. If the faulty controller continues to receive sensed data that causes it to detect a loss of power, the faulty controller causes the joint controller to disconnect the backup power supply 602 from the power rail 313 and instead provide braking current to the motor. A further backup power source 603 is connected to power rail 313.

The POST process described with reference to FIG. 7 is usefully implemented on each motor driving a joint of a robot arm. However, the fault controller may control only some of the joint controllers to apply electrical braking to their motors. The joints may be in a configuration that allows the arms to droop under gravity if not actively driven. These joints may be retractably driveable.

The fault controller may cause the entire robot arm to enter a fault state upon detecting a single fault of a single joint motor of the robot arm. In other words, the fault controller causes the entire robot arm to become stuck in its configuration, thereby holding the entire robot arm in place relative to gravity in response to detecting a fault in the robot arm's motor. obtain. Thus, a faulty controller may cause the joint controller to apply a braking current to a motor that is not faulty itself, but as a result of a fault detected in another motor in the robot arm.

Upon entering a fault condition, the fault controller issues one or more alarm signals. This includes audible signals such as alarms, visual signals displayed on the robot arm and/or its base and/or the robot arm operator's display, and felt through the hand controller for the robot arm operator to operate the robot arm. haptic signals or a combination thereof. Different alarms may be generated in the event that an additional backup power source is controlled to power the power rail.

If the robot arm's joint motor passes the POST procedure, the robot arm may continue normal use. During normal operation of the robotic arm, the fault controller may continue to monitor failures of some of the joint motors. Preferably, only a subset of the faults monitored during the POST process are monitored during normal use of the robotic arm. The faulty controller may continue with the following tests:
(i) Regarding failure of motor phase load switches 307, 308, and 309. This is implemented by receiving sensed data from current sensors 500a, 500b, 500c. The sensed data indicates when the current flowing through the load switch to the motor drive circuit of the motor phase exceeds the current limit of the current sensor. A fault controller detects a fault if the current limit is exceeded.
(ii) Regarding power supply failure. This is implemented by receiving sensor data from comparator 605. The sensed data indicates when the supply voltage falls below the threshold voltage. The fault controller detects a fault when the supply voltage falls below a threshold voltage.

The fault controller responds to the detection of a fault during normal operation by entering a fault condition and electrically braking the motor, as described above.

The apparatus and methods described herein address a single point of failure in a motor, e.g. allows the joint motor to be protected from motor winding or single transistor failure. The motor phase with a fault is isolated by opening the load switch. Opening the load switch also isolates the power supply from the motor phase, which is useful in the event that the fault is a short circuit on the motor phase.

The motors described herein usefully provide a circuit that independently disconnects each motor phase from the power rail via a load switch. This circuit is independent of the circuitry (eg, transistors) of the motor drive circuit used to generate the motor drive signal.

Preferably, the methods described herein are performed asynchronously. In other words, they are independent of the system clock. Therefore, fault detection and response can be performed even if the system clock fails.

The methods and apparatus described herein contemplate some functions controlled by joint controllers and other functions controlled by fault controllers. It will be appreciated that the functionality described herein may be distributed differently between joint and fault controllers. Functionality may be distributed among more controllers than joint and fault controllers. A single controller may perform all described functions. Each controller includes a processor for executing instructions to implement the methods described herein.

The instructions are computer-executable and may be provided using any computer-readable medium, such as memory. The methods described herein may be implemented by software in machine-readable form on a tangible storage medium. Software may be provided on a computing-based device to implement the methods described herein.

References to sense and test currents may alternatively be implemented by sense and test voltages according to methods known by those skilled in the art. Similarly, references to sense and test voltages may alternatively be implemented by sense and test currents according to methods known by those skilled in the art.

The robot described herein can be a surgical robot having a surgical instrument attachment with a surgical end effector. Alternatively, the robot may be an industrial robot or a robot for another function. The instrument may be an industrial tool.

Applicant hereby acknowledges that each individual feature described herein and any combination of two or more such features, whether such features or combinations are in the light of the general knowledge common to those skilled in the art. , regardless of whether such feature or combination of features solves any problem disclosed herein and limits the scope of the claims to the extent that can be done based on this specification as a whole. Disclose separately without doing so. The applicant indicates that aspects of the invention may consist of any such individual features or combinations of features. In view of the foregoing description, it will be apparent to those skilled in the art that various modifications may be made within the scope of the invention.
Note that the present invention includes the following contents as embodiments.
[Aspect 1]
A robot arm,
a first link connected to a second link by a joint, the first link allowing the second link to move relative to the first link;
a motor for driving the joint;
a controller for controlling the motor, the controller controlling the robot arm only when the joint is in a configuration such that the robot arm will droop under gravity if the joint is not actively driven; a controller configured to electrically brake the motor by applying a braking current to the motor to maintain a position of the joint relative to gravity in response to detecting a fault; A robot arm equipped with .
[Aspect 2]
The motor is a polyphase motor, and the polyphase motor includes, for each phase of the polyphase motor,
motor winding;
a motor drive circuit for applying a drive signal to the motor windings;
The robot arm according to aspect 1, comprising a load switch for connecting a power source to the motor drive circuit.
[Aspect 3]
the multi-phase motor comprises three phases, and the controller is configured to apply a braking current to all three phases of the motor in response to detecting the failure of the robot arm; The robot arm according to aspect 2.
[Aspect 4]
The controller, in response to the detection of the failure of the robot arm, adjusts the voltage from the first phase of the first pair to the first phase of the first pair only during the first pair of phases of the motors. The robot arm according to aspect 2 or 3, wherein the robot arm is configured to apply a braking current up to two phases.
[Aspect 5]
In response to continuing to detect a failure of the robot arm, the controller, subsequent to applying the braking current according to aspect 4, applies the braking current only during a second pair of phases of the motor. 5. The robot arm according to aspect 4, wherein the robot arm is configured to apply a braking current from the first phase of the two pairs to the second phase of the second pair.
[Aspect 6]
In response to continuing to detect a failure of the robot arm, the controller, subsequent to applying the braking current according to aspect 5, applies the braking current only during a third pair of phases of the motor. 6. The robot arm according to aspect 5, wherein the robot arm is configured to apply a braking current from the first phase of the third pair to the second phase of the third pair.
[Aspect 7]
In response to the controller continuing to detect a failure of the robot arm subsequent to applying the braking current according to aspect 6, only during the first pair of phases of the motor; 7. The robot arm of aspect 6, wherein the robot arm is configured to apply a braking current from the second phase of the first pair to the first phase of the first pair.
[Aspect 8]
In response to the controller continuing to detect a failure of the robot arm subsequent to applying the braking current according to aspect 7, only during the second pair of phases of the motor; 8. The robot arm of aspect 7, wherein the robot arm is configured to apply a braking current from the second phase of the second pair to the first phase of the second pair.
[Aspect 9]
In response to the controller continuing to detect a failure of the robot arm subsequent to applying the braking current according to aspect 8, only during the third pair of phases of the motor; 9. The robot arm of aspect 8, wherein the robot arm is configured to apply a braking current from the second phase of the third pair to the first phase of the third pair.
[Aspect 10]
The failure is a loss of power, and the controller electrically energizes the motor in response to detecting the loss of power by connecting the braking current to the motor from a primary power source external to the robot arm. The robot arm according to any one of aspects 1 to 9, configured to brake.
[Aspect 11]
The failure is a loss of power, and the controller electrically energizes the motor in response to detecting the loss of power by connecting the braking current to the motor from a backup power source external to the robot arm. The robot arm according to any one of aspects 1 to 10, wherein the robot arm is configured to brake.
[Aspect 12]
11. The robotic arm of aspect 10, wherein the robotic arm is mounted on a cart and the backup power source is a rechargeable battery contained within the cart.
[Aspect 13]
a further backup connected to the motor independently of the primary power source and backup power source in response to the controller continuing to detect a loss of power subsequent to applying a braking current according to aspect 11; 13. A robot arm according to aspect 11 or 12, configured to connect the braking current to the motor from a power source.
[Aspect 14]
14. The robotic arm of aspect 13, wherein the further backup power source is a non-rechargeable battery capable of providing only sufficient power to maintain the position of the joint relative to gravity for less than 5 minutes.
[Aspect 15]
In response to detecting a failure in a single phase of the polyphase motor, the controller:
opening the load switch of the single phase so as to isolate the motor winding of the single phase from the motor;
15. The robot arm according to aspect 2 or any one of aspects 3 to 14 when dependent on aspect 2, wherein the robot arm is configured to apply a braking current to the other phase of the motor.
[Aspect 16]
the motor comprises a current sensor between the load switch and the motor drive circuit for each phase of the multiphase motor, signaling a fault in the phase to the controller when a current limit is exceeded; 16. The robotic arm of aspect 15, wherein the current sensor is configured to.
[Aspect 17]
Each motor drive circuit is configured to drive its respective motor winding in a pulse width modulation (PWM) mode, the motor drive circuit comprising a high-side transistor and a low-side transistor for driving the PWM signal. Equipped with
The motor further includes a circuit for detecting that the high-side transistor and the low-side transistor are operating to generate the PWM signal for each phase of the multi-phase motor, the circuit comprising: 17. A robotic arm according to aspect 15 or 16, configured to signal a failure in the phase to the controller if the PWM signal is not generated.
[Aspect 18]
a first comparator configured to compare the voltage applied to the winding during high pulses of the PWM signal to a high threshold; and a first comparator configured to compare the voltage applied to the winding during low pulses of the PWM signal; a second comparator configured to compare the voltage applied to the winding with a lower threshold; the circuit is configured to compare the voltage applied to the winding with a lower threshold; 18. The robot arm of aspect 17, wherein the robot arm is configured to signal a failure to the controller if .
[Aspect 19]
The robot according to aspect 17 or 18, wherein the high-side transistor and low-side transistor of each motor drive circuit are connected in series, and each motor drive circuit further includes a capacitor connected in parallel with the high-side and low-side transistors. arm.
[Aspect 20]
The joint allows the second link to rotate about an axis relative to the first link, and the braking current changes the rotational position of the joint relative to the current configuration of the robot arm. 20. A robot arm according to any one of the preceding aspects, wherein the robot arm is adapted to provide a locking torque to the joint so as to lock it.
[Aspect 21]
21. The robotic arm of aspect 20, wherein the braking current provides an initial torque to the joint to stop movement of the joint before providing the locking torque.

Claims (13)

A robot arm,
a first link connected to a second link by a joint, the first link allowing the second link to move relative to the first link;
a motor for driving the joint;
a controller for controlling the motor, the controller controlling the robot arm only when the joint is in a configuration such that the robot arm will droop under gravity if the joint is not actively driven; a controller configured to electrically brake the motor by applying a braking current to the motor to maintain a position of the joint relative to gravity in response to detecting a fault; , comprising ;
The motor is a polyphase motor, and the polyphase motor includes, for each phase of the polyphase motor,
motor winding;
a motor drive circuit for applying a drive signal to the motor windings;
a load switch for connecting a power source to the motor drive circuit;
In response to detecting a failure in a single phase of the polyphase motor, the controller:
opening the load switch of the single phase so as to isolate the motor winding of the single phase from the motor;
and applying a braking current to another phase of the motor . the multi-phase motor comprises three phases, and the controller is configured to apply a braking current to all three phases of the motor in response to detecting the failure of the robot arm; The robot arm according to claim 1 . The controller, in response to the detection of the failure of the robot arm, changes the voltage from the first phase of the first pair to the second phase of the first pair only during the first pair of phases of the motors. The robot arm according to claim 1 or 2 , wherein the robot arm is configured to apply a braking current up to the phase. In response to the controller continuing to detect a failure of the robot arm subsequent to applying the braking current of claim 3 , only during a second pair of phases of the motor; 4. The robot arm of claim 3, wherein the robot arm is configured to apply a braking current from a first phase of the second pair to a second phase of the second pair. In response to continuing to detect a failure of the robot arm, the controller, subsequent to applying the braking current of claim 4 , applies the braking current only during a third pair of phases of the motor. 5. The robot arm of claim 4 , wherein the robot arm is configured to apply a braking current from a first phase of a third pair to a second phase of the third pair. only during the first pair of phases of the motor in response to the controller continuing to detect a failure of the robot arm subsequent to applying the braking current of claim 5 ; 6. The robot arm of claim 5 , configured to apply a braking current from the second phase of the first pair to the first phase of the first pair. only during the second pair of phases of the motor in response to the controller continuing to detect a failure of the robot arm subsequent to applying the braking current of claim 6 ; 7. The robot arm of claim 6 , configured to apply a braking current from the second phase of the second pair to the first phase of the second pair. only during the third pair of phases of the motor in response to the controller continuing to detect a failure of the robot arm subsequent to applying the braking current according to claim 7 ; 8. The robot arm of claim 7 , configured to apply a braking current from the second phase of the third pair to the first phase of the third pair. The failure is a loss of power, and the controller electrically energizes the motor in response to detecting the loss of power by connecting the braking current to the motor from a backup power source external to the robot arm. 9. Any one of claims 1 to 8 , wherein the robot arm is configured to brake, the robot arm is mounted on a cart, and the backup power source is a rechargeable battery contained within the cart. The robot arm described in . The controller is connected to the motor independently of the primary power source and the backup power source in response to continuing to detect a loss of power subsequent to applying the braking current of claim 9 . configured to connect the braking current to the motor from a further backup power source, the further backup power source providing only sufficient power to maintain the position of the joint relative to gravity for less than 5 minutes; 10. The robot arm of claim 9 , wherein the robot arm is a non-rechargeable battery. the motor comprises a current sensor between the load switch and the motor drive circuit for each phase of the multiphase motor, signaling a fault in the phase to the controller when a current limit is exceeded; A robot arm according to any one of claims 1 to 10 , wherein the current sensor is configured to. Each motor drive circuit is configured to drive its respective motor winding in a pulse width modulation (PWM) mode, the motor drive circuit comprising a high-side transistor and a low-side transistor for driving the PWM signal. Equipped with
The motor further includes a circuit for detecting that the high-side transistor and the low-side transistor are operating to generate the PWM signal for each phase of the multi-phase motor, the circuit comprising: A robot arm according to any preceding claim, configured to signal a fault in the phase to the controller if the PWM signal is not generated. The joint allows the second link to rotate about an axis relative to the first link, and the braking current changes the rotational position of the joint relative to the current configuration of the robot arm. Robotic arm according to any one of the preceding claims, wherein a locking torque is provided to the joint so as to lock it .

Images